Vendor
Apache Software Foundation
3,566 known vulnerabilities in products by Apache Software Foundation, 46 of them actively exploited (CISA KEV).
Key figures
3,566
Vulnerabilities
46
Actively exploited (KEV)
9
Used by ransomware
672
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-41773 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-1273 | VMware Tanzu Spring Data Commons Property Binder Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability In CISA KEVRansomware | 8.1 | |
| Critical | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2024-38856 | Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code In CISA KEV | 9.8 | |
| Critical | CVE-2024-32113 | Apache OFBiz: Path traversal leading to RCE In CISA KEV | 9.8 | |
| Critical | CVE-2024-27348 | Apache HugeGraph-Server: Command execution in gremlin In CISA KEV | 9.8 | |
| Critical | CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-38475 | Apache HTTP Server Improper Escaping of Output Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2022-24706 | Remote Code Execution Vulnerability in Packaging In CISA KEV | 9.8 | |
| Critical | CVE-2022-24112 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header In CISA KEV | 9.8 | |
| Critical | CVE-2013-2251 | Apache Struts Improper Input Validation Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-13927 | Apache Airflow's Experimental API Authentication Bypass In CISA KEV | 9.8 | |
| Critical | CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2017-9791 | Apache Struts 1 Improper Input Validation Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2016-3088 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability In CISA KEV | 9.8 |
News
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- NCSC-2026-0375 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Communicationsncsc-nl,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- Nucleus wants to get ahead of scanners on new vulnerabilitiescsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,